<!DOCTYPE html PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'>
<html><head><meta http-equiv="Content-Type" content="text/html;charset=us-ascii">
<style>BODY{font:10pt Tahoma,Verdana,sans-serif} .MsoNormal{line-height:120%;margin:0}</style></head><body>
<DIV>So I am trying to understand the flow timeouts better. So flow timeouts are the maximum time Suricata has to process the packets, correct? So increasing the flow timeout gives a better chance to getting the packets completely processed, correct?</DIV>
<DIV> </DIV>
<DIV>IPS takes longer to process packets than IDS, correct? Could explain why packets are being dropped and not making it through the processing chain so that the SSL VPN is not getting the packets, correct?</DIV>
<DIV> </DIV>
<DIV>Thanks.</DIV><BR>Leonard<BR>
<BLOCKQUOTE style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid; MARGIN-RIGHT: 0px">
<HR>
<B>From:</B> Victor Julien [mailto:lists@inliniac.net]<BR><B>To:</B> oisf-users@openinfosecfoundation.org<BR><B>Sent:</B> Tue, 14 May 2013 09:06:00 -0600<BR><B>Subject:</B> Re: [Oisf-users] Question on combined protocols<BR><BR>Btw you mail server still rejects my emails, very annoying to get an<BR>error each time I mail you:<BR><BR>he original message was received at Tue, 14 May 2013 15:46:19 +0200<BR>from a80-101-90-58.adsl.xs4all.nl [80.101.90.58]<BR><BR>----- The following addresses had permanent fatal errors -----<BR><<A href="mailto:ljacobs@netsecuris.com">ljacobs@netsecuris.com</A>><BR>(reason: 550 5.7.1 Service unavailable; Client host [83.215.238.27]<BR>blocked using Trend Micro RBL+. Please<BR>s...ail-abuse.com/cgi-bin/lookup?ip_address=83.215.238.27; User defined<BR>policy matched for 83.215.238.27)<BR><BR>----- Transcript of session follows -----<BR>... while talking to in.sjc.mx.trendmicro.com.:<BR>>>> DATA<BR><<< 550 5.7.1 Service unavailable; Client host [83.215.238.27] blocked<BR>using Trend Micro RBL+. Please see<BR><A href="http://www.mail-abuse.com/cgi-bin/lookup?ip_address=83.215.238.27;" target=_blank>http://www.mail-abuse.com/cgi-bin/lookup?ip_address=83.215.238.27;</A> User<BR>defined policy matched for 83.215.238.27<BR>550 5.1.1 <<A href="mailto:ljacobs@netsecuris.com">ljacobs@netsecuris.com</A>>... User unknown<BR><<< 554 5.5.1 Error: no valid recipients<BR><BR><BR>On 05/14/2013 04:02 PM, Victor Julien wrote:<BR>> On 05/14/2013 02:52 PM, Leonard Jacobs wrote:<BR>>> According to references on the web, SonicWALL Adventail SSL VPN uses non-RFC compliant SSL VPN by using SOCKS over HTTPS. The references refer to problems similar to what we experience with af-packet IPS mode where packets are getting dropped (not due to IPS but just flow stops). When doing a packet capture, we see a lot of TCP Retransmissions. According to references, turning off statefull inspection for 443 on firewall solves the problem but Suricata is not a firewall so there is no stateful inspection.<BR>>><BR>>> I am suggesting to the firewall folks that they need to turn off stateful inspection for this SSL VPN traffic because the SSL VPN device is in a DMZ on their firewall. They are checking with firewall vendor.<BR>> <BR>> Suricata's inspection is definitely stateful.<BR>> <BR>>> IDS mode with Suricata works fine.<BR>>><BR>>> We have tried decreasing the TCP flow timeouts but that does not solve the problem. We have considered using an alternative IPS to Suricata as a test to see if the problem goes away.<BR>> <BR>> I would suggest /increasing/ the time outs, not decreasing.<BR>> <BR>>> Do you have any ideas or suggestions?<BR>> <BR>> To me it sounds like your SSL product is broken, so I'd push them for a<BR>> fix. If their answer is to disable stateful inspection, you know they<BR>> have problems for sure.<BR>> <BR>> Cheers,<BR>> Victor<BR>> <BR>> <BR>>><BR>>> Thanks.<BR>>><BR>>> -----Original Message-----<BR>>> From: <A href="mailto:oisf-users-bounces@openinfosecfoundation.org">oisf-users-bounces@openinfosecfoundation.org</A> [mailto:<A href="mailto:oisf-users-bounces@openinfosecfoundation.org">oisf-users-bounces@openinfosecfoundation.org</A>] On Behalf Of Victor Julien<BR>>> Sent: Tuesday, May 14, 2013 5:43 AM<BR>>> To: <A href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</A><BR>>> Subject: Re: [Oisf-users] Question on combined protocols<BR>>><BR>>> On 05/13/2013 08:47 PM, Leonard Jacobs wrote:<BR>>>> <BR>>>> Would Suricata and af-packet in IPS mode have difficulty processing <BR>>>> network traffic using combined protocols such as SOCKS over HTTPS?<BR>>><BR>>> It shouldn't have. Are you seeing problems?<BR>>><BR>>> --<BR>>> ---------------------------------------------<BR>>> Victor Julien<BR>>> <A href="http://www.inliniac.net/" target=_blank>http://www.inliniac.net/</A><BR>>> PGP: <A href="http://www.inliniac.net/victorjulien.asc" target=_blank>http://www.inliniac.net/victorjulien.asc</A><BR>>> ---------------------------------------------<BR>>><BR>>> _______________________________________________<BR>>> Suricata IDS Users mailing list: <A href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</A><BR>>> Site: <A href="http://suricata-ids.org" target=_blank>http://suricata-ids.org</A> | Support: <A href="http://suricata-ids.org/support/" target=_blank>http://suricata-ids.org/support/</A><BR>>> List: <A href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target=_blank>https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</A><BR>>> OISF: <A href="http://www.openinfosecfoundation.org/" target=_blank>http://www.openinfosecfoundation.org/</A><BR>>><BR>> <BR>> <BR><BR><BR>-- <BR>---------------------------------------------<BR>Victor Julien<BR><A href="http://www.inliniac.net/" target=_blank>http://www.inliniac.net/</A><BR>PGP: <A href="http://www.inliniac.net/victorjulien.asc" target=_blank>http://www.inliniac.net/victorjulien.asc</A><BR>---------------------------------------------<BR><BR>_______________________________________________<BR>Suricata IDS Users mailing list: <A href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</A><BR>Site: <A href="http://suricata-ids.org" target=_blank>http://suricata-ids.org</A> | Support: <A href="http://suricata-ids.org/support/" target=_blank>http://suricata-ids.org/support/</A><BR>List: <A href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target=_blank>https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</A><BR>OISF: <A href="http://www.openinfosecfoundation.org/" target=_blank>http://www.openinfosecfoundation.org/</A><BR></BLOCKQUOTE>
<STYLE>
</STYLE>
<DIV> </DIV>
<DIV> </DIV></body></html>